CVE-2025-11683: YAML::Syck versions before 1.36 for Perl has missing Null-Terminators which causes Out-of-Bounds Read and potential Information Disclosure
YAML::Syck versions before 1.36 for Perl has missing null-terminators which causes out-of-bounds read and potential information disclosure Missing null terminators in token.c leads to but-of-bounds read which allows adjacent variable to be read The issue is seen with complex YAML files with a hash of all keys and empty values. There is no indication that the issue leads to accessing memory outside that allocated to the module.
Affected Software
Remediation
Information
Event History
Frequently Asked Questions
What is the severity of CVE-2025-11683?
CVE-2025-11683 has a medium severity due to potential information disclosure through out-of-bounds reads.
What versions of YAML::Syck are affected by CVE-2025-11683?
CVE-2025-11683 affects YAML::Syck versions prior to 1.36.
How do I fix CVE-2025-11683?
To fix CVE-2025-11683, update YAML::Syck to version 1.36 or later.
What causes the vulnerability in CVE-2025-11683?
CVE-2025-11683 is caused by missing null-terminators in the token.c file, leading to out-of-bounds reading.
Can CVE-2025-11683 lead to any security risks?
Yes, CVE-2025-11683 can lead to information disclosure risks by allowing adjacent variables to be read.